Policies

Create a policy

Create a user-authored policy. scope_id is auto-filled from context when omitted (layer 1 → null, layer 2 → org_id, layer 3 → tenant_id); layer 4 requires an explicit workflow_id. Layer-3 policies are validated stricter-wins against the parent org (422 policy_looser_than_parent when looser). Auth: NextAuth session OR an sk_live_ API key (Authorization: Bearer or X-API-Key); requires the admin role.

post/api/v1/tenants/{tenantId}/policies

Request

  • Base URL: http://dobby-ai.com
  • URL: http://dobby-ai.com/api/v1/tenants/{tenantId}/policies
  • Auth: HTTP bearer

Path parameters

tenantIdstring required

Tenant (workspace) ID

Request body

layerinteger required

1=Platform, 2=Org, 3=Tenant, 4=Process

scope_idstring nullable

Scope of the policy — auto-filled per layer when omitted; workflow_id for layer 4

textstring required

The policy text (natural language)

severity'critical' | 'high' | 'medium' | 'low' required
is_activeboolean

Example request

{
  "text": "Never send customer PII to external email addresses"
}

Response

Policy created

successboolean
inline_enforcementobject

Whether the policy compiled into a live inline-enforcement rule for /controls/check

Example response

{
  "success": true,
  "data": {
    "policy_id": "pol_user_abc123",
    "layer": 3,
    "text": "Never send customer PII to external email addresses",
    "source": "user_authored",
    "severity": "high",
    "is_active": true,
    "version": 1
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.